Securing Cloud-Native Applications via Infrastructure as Code and DevOps

A cloud-native application is kind of software built to fully leverage a cloud computing environment, rather than being a traditional application adapted for the cloud. The goal is to create agile, resilient, and scalable applications that can be deployed and managed efficiently in any cloud environment. It is a layered approach with four layers (4C) that need to be secured, including the code, the container, the cluster, and the cloud. Due to its importance, security is a priority for such applications. To enhance the security, it needs to be built into the application and infrastructure from the ground up, rather than added on as an afterthought. This requires a combination of automated security controls. Motivated by this requirement, in this work, we aim to build a secure cloud-native infrastructure via cloud-native technologies such as infrastructure as code (IaC) and DevOps, and demonstrate its performance by deploying it on a public cloud provider AWS (Amazon Web Services).